Researchers Find Rentable Proxy Exits on White House Network
Layer3 Intel said 28 residential proxy services let customers route traffic out of the White House network from Oct. 5 to Nov. 3, KrebsOnSecurity reported.
Featured photo: the north facade of the White House (file photo). Photo: Nishkid64, Wikimedia Commons, public domain, cropped.
WASHINGTON — Security researchers said they found residential proxy services selling access that exits through the internet address space of the Executive Office of the President, KrebsOnSecurity reported on Nov. 4, 2026.
A residential proxy lets a customer rent someone else’s internet address so their traffic appears to come from that address. Software development kits built into some free apps can turn a device into a proxy node, The Verge reported.
What the researchers found
The security firm Layer3 Intel said it detected proxy nodes beaconing from AS2650, the network reserved for the Executive Office of the President, KrebsOnSecurity reported. Layer3 said 28 separate residential proxy services could exit through that network between Oct. 5 and Nov. 3.
The proxies exited from the White House network 236 times in that period, from six internet addresses on 26 of the 30 days, Layer3 said, according to KrebsOnSecurity. Most of the activity occurred between 5 p.m. and midnight ET, the firm said.
Layer3 said that pattern suggests a person regularly on the network in the evening whose device runs a proxy SDK, rather than a public guest Wi-Fi network, The Verge reported. “Anybody can obtain it by signing up to a public residential proxy service, paying a few dollars,” Layer3 wrote, according to KrebsOnSecurity.
The Russian-founded provider
The proxy tracking firm Synthient said the traffic it saw was tied to several Windows 11 installations of a service called Infatica, KrebsOnSecurity reported. Infatica’s founder previously ran a hosting firm that hosted six of the eight addresses used by Russian state security services to breach election databases in Arizona and Illinois in 2016, KrebsOnSecurity reported.
The identity of the devices or users involved has not been made public. The White House did not immediately respond to a request for comment, KrebsOnSecurity reported.
Why it matters to defenders
Synthient founder Ben Brundage told KrebsOnSecurity that some resellers sell bandwidth for as little as 60 cents a gigabyte. The proxy tracking service Spur said in January 2026 that it found residential proxies in nearly 300 government-owned or government-operated networks, KrebsOnSecurity reported.
What it means
Analysis: The finding is unconfirmed by the White House, and the researchers’ data shows exit points, not what traffic passed through them. Even so, a rentable exit from a presidential network would let outsiders make their traffic look like it came from inside it. That can help attackers slip past filters that trust government address ranges.
Sources
- KrebsOnSecurity: Want to Rent an Internet Address at the White House?
- The Verge: Just about anyone can rent access to White House IP addresses
Related coverage
- House Intel Says No Midterm Vote-System Interference Seen
- Zero trust shifts security from networks to resources
- CISA, NSA and FBI Warn of China-Linked Data Theft Campaign
